154 lines
3.6 KiB
Markdown
154 lines
3.6 KiB
Markdown
# Sublist3r (fork by Mazen Nafee)
|
|
|
|
**Fork of** aboul3la/Sublist3r — maintained by Mazen Nafee.
|
|
This fork focuses on robustness, tests, and developer ergonomics:
|
|
|
|
- Defensive DNSdumpster CSRF extraction (regex + BeautifulSoup fallback).
|
|
- Validation and safe handling of nameserver entries to avoid dnspython errors.
|
|
- Unit tests and small repro scripts for the fixes.
|
|
- GitHub Actions CI to run tests on push and pull requests.
|
|
|
|
---
|
|
|
|
## About
|
|
|
|
Sublist3r is a Python tool for enumerating subdomains using OSINT. It helps penetration testers and bug hunters collect subdomains for a target domain by querying search engines and public services. Sublist3r supports multiple sources including Google, Yahoo, Bing, Baidu, Ask, Netcraft, VirusTotal, ThreatCrowd, DNSdumpster, and ReverseDNS.
|
|
|
|
Subbrute is integrated to increase coverage via bruteforce using an improved wordlist. Credit for subbrute goes to TheRook.
|
|
|
|
---
|
|
|
|
## Quick start
|
|
|
|
```bash
|
|
# clone the fork
|
|
git clone https://github.com/mazennafee/Sublist3r.git
|
|
cd Sublist3r
|
|
|
|
# create and activate a virtual environment
|
|
python -m venv .venv
|
|
source .venv/bin/activate
|
|
|
|
# install editable and test dependencies
|
|
pip install --upgrade pip
|
|
pip install -e .
|
|
pip install -r requirements.txt || true
|
|
|
|
# run tests
|
|
pytest -q
|
|
|
|
Usage
|
|
|
|
Command line
|
|
|
|
# basic usage
|
|
python3 ./sublist3r.py -d example.com
|
|
|
|
# use the console script after activating venv
|
|
sublist3r -d example.com -t 10 -o results.txt
|
|
|
|
Options
|
|
|
|
-d, --domain Domain name to enumerate subdomains of
|
|
|
|
-b, --bruteforce Enable the subbrute bruteforce module
|
|
|
|
-p, --ports Scan found subdomains against specific TCP ports
|
|
|
|
-v, --verbose Enable verbose mode and display results in realtime
|
|
|
|
-t, --threads Number of threads to use for bruteforce or lookups
|
|
|
|
-e, --engines Comma separated list of search engines to use
|
|
|
|
-o, --output Save results to a text file
|
|
|
|
-h, --help Show help and exit
|
|
|
|
Examples
|
|
|
|
# show help
|
|
python3 sublist3r.py -h
|
|
|
|
# enumerate subdomains
|
|
python3 sublist3r.py -d example.com
|
|
|
|
# enumerate and scan ports 80 and 443
|
|
python3 sublist3r.py -d example.com -p 80,443
|
|
|
|
# enable bruteforce
|
|
python3 sublist3r.py -b -d example.com
|
|
|
|
|
|
Using Sublist3r as a module
|
|
|
|
import sublist3r
|
|
|
|
subdomains = sublist3r.main(
|
|
domain="example.com",
|
|
no_threads=40,
|
|
savefile="example_subdomains.txt",
|
|
ports=None,
|
|
silent=False,
|
|
verbose=False,
|
|
enable_bruteforce=False,
|
|
engines=None
|
|
)
|
|
|
|
print(len(subdomains), "unique subdomains found")
|
|
|
|
Return value The main function returns a set of unique subdomain strings.
|
|
|
|
Dependencies and supported Python versions
|
|
Supported Python This fork targets Python 3.8 or newer.
|
|
|
|
Key dependencies
|
|
|
|
requests
|
|
|
|
dnspython
|
|
|
|
beautifulsoup4
|
|
|
|
Install dependencies with:
|
|
pip install -r requirements.txt
|
|
Add or update requirements.txt with pinned minimums for reproducible installs.
|
|
|
|
Tests and CI
|
|
This fork includes unit tests and small repro scripts under tests/ and a GitHub Actions workflow at .github/workflows/ci.yml that runs pytest on push and pull requests.
|
|
|
|
Run tests locally:
|
|
pytest -q
|
|
|
|
License
|
|
This project is licensed under the GNU GPL v2. See the LICENSE file for details.
|
|
|
|
Credits
|
|
|
|
TheRook — subbrute integration and bruteforce approach
|
|
|
|
Bitquark — inspiration for the subbrute wordlist
|
|
|
|
Ahmed Aboul-Ela — original Sublist3r project
|
|
|
|
Contributing
|
|
|
|
If you want to contribute, please:
|
|
|
|
Fork the repository and create a feature branch.
|
|
|
|
Add tests for new behavior.
|
|
|
|
Open a pull request with a clear description and reproduction steps.
|
|
|
|
See CONTRIBUTING.md for more details.
|
|
|
|
Changelog
|
|
Unreleased
|
|
|
|
Defensive DNSdumpster CSRF extraction and fallback parsing.
|
|
|
|
Nameserver validation to avoid dnspython errors.
|
|
|
|
Unit tests and CI added.
|